Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Work > Chap 9 - putting it together > Flashcards

Chap 9 - putting it together Flashcards

1
Q

what is governance

A

align or link the organizations’ overall goals and objectives to the lower-level security and asset protection goals and objectives that security professionals help establish, operate and maintain

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

what are policies

A

mandatory

are formally prepared, authoritatively issued directions or statements of intent that senior leadership provides to the organization

to be effective as directive, it must be explicitly linked to an enforcement mechanism

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

what are procedures

A

mandatory

define the explicit, repeatable activities necessary to accomplish a specific task or set of task

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

what are guidelines

A

non-mandatory

act as advisory information and can offer insights drawn from experience and observation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

what are standards

A

mandatory

cover a broad range of issues and ideas (NIST, ISO)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

what is the breadth and depth in administrative controls (steps)

A
  1. Policies
  2. standards
  3. guidelines
  4. procedures
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

what is COBIT framework

A

way to manage and document enterprise IT and IT security functions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

what is ITIL

A

IT service set of best practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

what is a security framework

A

establish a starting set of security requirements or data protection drivers for the workflow as a whole. the framework also establish the success criteria used to assess the in-use system and its controls for compliance and security assessment purposes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

what is a risk framework (ERM)

A

similar to security control frameworks, the security professional may also make use of dedicated risk management frameworks to optimize the organization’s response to risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

role of forensic investigation tools

A

the tools of digital forensics are put into action moments after an incident or malfunction has been detected. these tools and processes are used to gather data, some of which may be used as evidence in a more formal investigation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

how to maintain integrity of an investigation

A
  • respect ethical walls
  • non-disclosure
  • evidence handling
  • respect rights of individuals and other parties
  • communication with outside persons conducted through appropriate channels
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

what are key steps in digital forensic investigation

A
  • appoint an evidence custodian
  • maintain a chain of custody
  • use backups
  • make copies of all original evidence

maintain the chain of evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

what are admissible evidence in court

A

admissibility: evidence that is acceptable to the court may be presented. must be:

  • accurate
  • comprehensible
  • objective
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

what are the 4 types of investigation

A
  • administrative (internal)
  • civil
  • regulatory
  • criminal
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

what is a business impact analysis (BIA)

A

the BIA is the effort to determine the value of each asset belonging to the organization, as well as the potential risk of losing assets, the threat likely to affect the organization

BIA provides the foundation to determine the overall scope and extent of the BCDR plans

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

3 key control parameters for BCDR

A
  • maximum allowable downtime (MAD) = amount of downtime without causing significant/unacceptable harm to organization
  • recovery time objective (RTO) = target time for recovery (less then MAD). BCDR strategy and plans must support achieving the desired RTO
  • recovery point objective (RPO) = amount of data the organization can lose before unacceptable harm caused to organization. RPO is usually a storage amount (refer to data loss)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

what are the key parameters must establish for response activation

A
  1. criteria for initiating the response action
  2. personnel authorized to initiate BCDR action
  3. information chain to provide the decision making authority with sufficient data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

what are the key participants in response team

A
  • responders
  • IT
  • security
  • legal
  • human resources
  • finance/accounting
  • public relations/communications
  • senior management / leadership
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

why is assessment of loss critical

A
  • criminal prosecution -> determine the damage
  • civil actions -> determine the damage
  • investors reporting
  • informing regulators
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

how can human factor of risk be limited

A

candidate screening & hiring process
1. detailed & reliable job description
2. checking candidate references
3. checking employment history
4. performing a background check
5. assessing a financial profile

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

3 main employment agreements & policies

A
  1. employee handbook
  2. employee contract
  3. NDA
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

what are the various types of NDAs

A
  • unilateral NDA
  • bilateral NDA
  • multilateral NDA
  • non-compete agreement
24
Q

what are the main consideration when engaging vendor, consultant, contractors etc.

A
  • contractual protections
  • NDA and NCA
  • distinct restricted account
  • escort requirement
  • distinguishing ID
25
Q

what are the categories of NIST Cyber Security Framework

A
  • identify
  • protect
  • detect
  • respond
  • recover
26
Q

what are the 4 perspective to define “what is at risk”

A
  • asset-based
  • outcome-based and process-based
  • vulnerability-based
  • threat-based
27
Q

what is “Risk”

A

a possible event which can have a negative impact upon the organization

28
Q

what is hazard

A

a precondition of a system, workplace, environment that could cause a risk

29
Q

what is a vulnerability

A

an inherent weakness or flaw in a system or component

30
Q

what is a threat

A

human actor or group that makes the deliberate decision to exploit a vulnerability to cause harm

31
Q

what are the four choice when confronted to risk

A
  1. mitigate
  2. avoid
  3. transfer
  4. accept
32
Q

what can risk be mitigated

A
  1. remediation measures
  2. risk controls or security controls implemented

even after all measures implemented there is still a “RESIDUAL RISK”

33
Q

what is risk avoidance

A

cease operating some activities of the organization that are exposed to particular risk

34
Q

what is risk transfer

A

practice of paying another party to accept the risk (e.g., insurance)

35
Q

what is risk acceptance

A

it is the opposite of avoidance. decide to conduct activities despite the risk, because the impact or likelihood is negligible

36
Q

what are the 3 meanings of risk exposure

A
  1. exposure window measures over time the likelihood or probability of occurance of a risk event
  2. risk exposure factor (EF) is an estimated fraction of an asset’s or outcome value to the organization that is reduced y a single occurrence of a risk event
  3. exposure estimation is a description of how certain risks are categorically much lower or higher than others for given organization
37
Q

what are both type of risk assessment

A
  1. qualitative = giving relative ranking (e.g., High, low)
  2. quantitative = numeric value to probability & impact
38
Q

when to use qualitative assessment

A
  • newness
  • uniqueness
  • time limitation
  • no reliable measuring method
39
Q

when to use a quantitative approach

A
  • business process
  • measurement techniques - precise and reliable
  • experience with process and data quantity
40
Q

risk assessment method (math)

A

annual loss expectancy (ALE) = SLE x ARO

ARO = annual rate occurrence = number of times given impact is expected to happen

SLE = Single Loss Expectancy = expected impact related to risk

SLE = AV x EF

AV = asset value
EF = exposure factor = fraction from 0-1 that represent the amount of damage to the asset (0 no damage / 1 fully damage)

41
Q

what are the elements of STRIDE (threat modeling)

A
  • spoofing ID
  • tampering with data
  • repudiation
  • information disclosure
  • DoS
  • elevation of privilege
42
Q

what are the 3 applicable types of controls

A
  1. administrative
  2. logical/technological
  3. physical
43
Q

what are the categories of security controls

A
  1. directive / administrative
  2. deterrent
  3. preventive
  4. compensating
  5. detective
  6. corrective
  7. recovery
44
Q

what are the various technics to present awareness & training

A
  1. computing-based training (CBT)
  2. live in-person training
  3. online synchronous training
  4. regular communications
  5. reward mechanism
  6. gamification
45
Q

What is the final step of a quantitative risk analysis?
A. Determine asset value.
B. Assess the annualized rate of occurrence.
C. Derive the annualized loss expectancy.
D. Conduct a cost/benefit analysis.

A

Conduct a cost/benefit analysis.

The final step of a quantitative risk analysis is conducting a cost/benefit analysis to determine whether the organization should implement proposed countermeasure(s).

46
Q

Tony is developing a business continuity plan and is having difficulty prioritizing resources because of the difficulty of combining information about tangible and intangible assets. What would be the most effective risk assessment approach for him to use?

A

Combination of quantitative and qualitative risk assessment

47
Q

Which one of the following actions might be taken as part of a business continuity plan?
A. Restoring from backup tapes
B. Implementing RAID
C. Relocating to a cold site
D. Restarting business operations

A

B. Implementing RAID

RAID technology provides fault tolerance for hard drive failures and is an example of a business continuity action.

Restoring from backup tapes, relocating to a cold site, and restarting business operations are all disaster recovery actions.

48
Q

Which one of the following is not normally included in business continuity plan documentation?
A. Statement of accounts
B. Statement of importance
C. Statement of priorities
D. Statement of organizational responsibility

A

A. Statement of accounts

Business continuity plan documentation normally includes

the continuity planning goals,
a statement of importance,
statement of priorities,
statement of organizational responsibility,
statement of urgency and timing,
risk assessment & risk acceptance & mitigation docs,
a vital records program, emergency response guidelines,
and documentation for maintaining and testing the plan.

49
Q

Which one of the following is not normally considered a business continuity task?
A. Business impact assessment
B. Emergency response guidelines
C. Electronic vaulting
D. Vital records program

A

C. Electronic vaulting

Electronic vaulting is a data backup task that is part of disaster recovery, not business continuity, efforts.

50
Q

Which one of the following actions is not normally part of the project scope and planning phase of business continuity planning?
A. Structured analysis of the organization
B. Review of the legal and regulatory landscape
C. Creation of a BCP team
D. Documentation of the plan

A

D. Documentation of the plan

The project scope and planning phase includes four actions:
1. a structured analysis of the organization,
2. the creation of a BCP team,
3. an assessment of available resources,
4. an analysis of the legal and regulatory landscape.

51
Q

Which one of the following stakeholders is not typically included on a business continuity planning team?
A. Core business function leaders
B. Information technology staff
C. CEO
D. Support departments

A

CEO

While senior management should be represented on the BCP team, it would be highly unusual for the CEO to fill this role personally

52
Q

COBIT, Control Objectives for Information and Related Technology, is a framework for IT management and governance. Which data management role is most likely to select and apply COBIT to balance the need for security controls against business requirements?
A. Business owners
B. Data processors
C. Data owners
D. Data stewards

A

A. Business owners

Business owners have to balance the need to provide value with regulatory, security, and other requirements. This makes the adoption of a common framework like COBIT attractive.

53
Q

Harold is assessing the susceptibility of his environment to hardware failures and would like to identify the expected lifetime of a piece of hardware. What measure should he use for this?

A

MTTF

The mean time to failure (MTTF) provides the average amount of time before a device of that particular specification fails.

54
Q

Ben’s development team needs to address an authorization issue, resulting in an elevation of privilege threat. Which of the following controls is most appropriate to this type of issue?
A. Auditing and logging is enabled.
B. RBAC is used for specific operations.
C. Data type and format checks are enabled.
D. User input is tested against a whitelist.

A

B. RBAC is used for specific operations.

Using role-based access controls (RBACs) for specific operations will help to ensure that users cannot perform actions that they should not be able to.

55
Q

Ben’s team is attempting to categorize a transaction identification issue that is caused by use of a symmetric key shared by multiple servers. What STRIDE category should this fall into?
A. Information disclosure
B. Denial of service
C. Tampering
D. Repudiation

A

D. Repudiation

Since a shared symmetric key could be used by any of the servers, transaction identification problems caused by a shared key are likely to involve a repudiation issue.

Work (9 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions